Devices running certain configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that allows attackers to log into devices without a password.
The vulnerability exists in the interaction between OpenSSH, the code library implementing SSH connections, and musl, a lightweight alternative to the libc library which, unlike most other Linux distributions, is used in Alpine. Additionally, OpenSSH using musl (pronounced muscle) should not use PAM (pluggable authentication modules), a framework that manages user authentication and account access controls. Alpine is a lightweight and widely used Linux distribution. Other platforms may be affected if they use the same configurations.
One connection, works every time, requires no retries
There are two other conditions necessary for successful exploitation. First, a system must have at least one user account that can be accessed using a password hashed using SHA256 or SHA512. Second, the target system account must be configured to be passwordless, by specifying a “*” in the password field in /etc/shadow, the Linux file where password hashes are stored. Passwordless accounts are commonly used for accounts that use certificate-based authentication. This setting is common for certain account types.
When all the conditions are met, the consequences are serious.
“An attacker who can access your SSH port can connect without knowing a password,” Alpine officials said Thursday. “It requires a single login, works every time, and requires no retries. »
When logging into an account without a password, the attacker can gain access by entering more than 256 characters in the password field.
Security firm Checkpoint said using SHA256 or SHA512 “is important because sshd borrows salt from that account. Without it, the attack fails.” The company’s researchers said their tests also showed that the account must be active and not just contain a hash. Checkpoint further reported that root accounts are secure through the default PermitRootLogin ban password setting, although accounts accessed with doas or sudo rights can still become root.
Gn tech
